django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.

Affected: PyPI: django-cms

## Impact

The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_add_page(user, site)` / `user_can_add_subpage(...)` — i.e. *“may this user create a page at all”*. Nothing checks the user’s relationship to the page being copied:

- `cms/admin/forms.py` — `DuplicatePageForm.source = ModelChoiceField(queryset=Page.objects.all(), widget=HiddenInput())` spans **every page in the database, on every site**. - `cms/admin/forms.py` — `AddPageForm.__init__` returns early when the `source` widget is hidden, so the queryset is **never narrowed** to the user’s site/subtree. - `cms/admin/forms.py` — `AddPageForm.clean()` validates only URL uniqueness; `source` is never validated against the user. - `cms/admin/pageadmin.py` — `duplicate()` seeds `source` from the URL **only on GET**; on POST the value comes entirely from the request body. - `cms/admin/forms.py` — `AddPageForm.save()` → `from_source()` performs `source.copy(..., permissions=False)` and copies **every placeholder and all plugins** of `source` into a new page on the attacker’s site. Because `permissions=False` drops the source’s view restrictions, the resulting copy is fully readable by the attacker.

This crosses a real privilege boundary: a staff user restricted (via `CMS_PERMISSION`) to their own site or subtree can exfiltrate the content of restricted pages and of pages belonging to other tenants.

**Read-back is trivial (verified):** the copy is created…

Affected: PyPI: django-cms

## Impact

The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_add_page(user, site)` / `user_can_add_subpage(...)` — i.e. *“may this user create a page at all”*. Nothing checks the user’s relationship to the page being copied:

- `cms/admin/forms.py` — `DuplicatePageForm.source = ModelChoiceField(queryset=Page.objects.all(), widget=HiddenInput())` spans **every page in the database, on every site**. - `cms/admin/forms.py` — `AddPageForm.__init__` returns early when the `source` widget is hidden, so the queryset is **never narrowed** to the user’s site/subtree. - `cms/admin/forms.py` — `AddPageForm.clean()` validates only URL uniqueness; `source` is never validated against the user. - `cms/admin/pageadmin.py` — `duplicate()` seeds `source` from the URL **only on GET**; on POST the value comes entirely from the request body. - `cms/admin/forms.py` — `AddPageForm.save()` → `from_source()` performs `source.copy(..., permissions=False)` and copies **every placeholder and all plugins** of `source` into a new page on the attacker’s site. Because `permissions=False` drops the source’s view restrictions, the resulting copy is fully readable by the attacker.

This crosses a real privilege boundary: a staff user restricted (via `CMS_PERMISSION`) to their own site or subtree can exfiltrate the content of restricted pages and of pages belonging to other tenants.

**Read-back is trivial (verified):** the copy is created…